European UnionGDPR Chapter V, Cross-Border Transfer Restrictions
Regulation (EU) 2016/679, Arts. 44-49
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Rely on a Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data covered by the Regulation outside the EEA.
These lines are LexLint's reading of the law's text. Also read by: European Data Protection Board (guidance, recorded ); Case C-311/18 Data Protection Commissioner v Facebook Ireland and Schrems, judgment of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 83(5)(c) subjects an infringement of the cross-border transfer conditions in Articles 44 to 49 to the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The data protection supervisory authority designated by each EU Member State under Article 51, coordinated on cross-border cases through the one stop shop mechanism, which does not apply to processing by public authorities or by private bodies acting under Article 6(1)(c) or (e) (Article 55(2)), and through the European Data Protection Board (Articles 68-76).
Enforcement record
Counts the fines that national data protection authorities imposed in calendar year 2025 (2,161): the sum of the number-of-fines column in the European Data Protection Board's Annual Report 2025, which gives for each of 30 authorities (the 27 Member States, Iceland, Liechtenstein and Norway) the number and the total amount of the fines it issued that year. The report's own total of those amounts is EUR 1,145,760,374. Fines only: the table does not count the reprimands, warnings, compliance orders or processing bans the authorities may also impose. Enforcement of the GDPR is national, and this table is the Board's Union-level count of it. The figures describe enforcement of the GDPR as a whole, not enforcement of Chapter V alone.
- As of
- Currency
- EUR
- Source link
- https://www.edpb.europa.eu/system/files/2026-04/edpb-annual-report-2025_en.pdf
- Fines per year
- 1,145,760,374
- Actions per year
- 2,161
Settledness
An appeal against the General Court's judgment of in Case T-553/23, Latombe v Commission, is pending before the Court of Justice as Case C-703/25 P.
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311
- Guidance link
- https://www.edpb.europa.eu/system/files/2023-02/edpb_guidelines_05-2021_interplay_between_the_application_of_art3-chapter_v_of_the_gdpr_v2_en_0.pdf
- Case citation
- Case C-311/18 Data Protection Commissioner v Facebook Ireland and Schrems, judgment of (Grand Chamber)
- Guidance body
- European Data Protection Board
- Open questions
- Which Article 46 safeguard may an exporter rely on for a transfer to an importer in a third country whose processing of the data is subject to Regulation (EU) 2016/679 under its Article 3(2), given that Article 1 of Decision 2021/914 covers only importers whose processing is not subject to that Regulation?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
Where a transfer rests on the compelling legitimate interests derogation in the second subparagraph of Article 49(1), the controller or processor must document the assessment and the suitable safeguards in its records of processing. Article 30, which holds the rule on who may obtain those records, is outside this row. Binding corporate rules separately provide for verification results that are available to the competent supervisory authority on request (Article 47(2), point (j)).
- Kind
- Explicit
- As of
- Provision
- Article 49(6)
- Trigger
- personal_data_processing
Also on the record
EEA status
- Annex
- XI
- Status
- Incorporated
- Force date
- Joint committee decision number
- 154/2018
- Source link
- https://www.efta.int/eea-lex/32016r0679
- Decision date
What this law does
Chapter V bars any transfer of personal data outside the EEA unless the European Commission has issued an adequacy decision (Article 45), the transfer is covered by an appropriate safeguard such as Binding Corporate Rules or Standard Contractual Clauses, or a narrow Article 49 derogation applies.
For transfers on standard clauses, the Court of Justice's Schrems II judgment (Case C-311/18, ) requires the exporter to verify case by case that the law of the destination country ensures adequate protection, adding safeguards where necessary. Transfers to United States organisations on the Data Privacy Framework List can rely on the EU-US Data Privacy Framework, found adequate by Commission Implementing Decision (EU) 2023/1795.
The General Court upheld that adequacy decision at first instance in Latombe v Commission (Case T-553/23, ). An appeal against that judgment is pending before the Court of Justice as Case C-703/25 P, with no hearing date set as of the date shown.
How courts have read itPremium data
Our analysis of this law draws on 2 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .